A forensic examiner has completed the analysis of a compromised server and must now write a report for management and legal counsel. Which characteristic is most important for the report to be legally defensible?

The report is written in highly technical jargon to demonstrate expertise.

The report is objective, factual, and clearly documents the methods and findings.

The report is short and only includes the final conclusion.

The report includes the examiner's personal opinions about the suspect's guilt.

An examiner is investigating a drive that appears to have very little free space, but the user's visible files only account for a fraction of the drive's capacity. The examiner suspects anti-forensic techniques. Which technique could explain the missing space?

The user compressed the drive to save space.

Data hidden in the slack space of existing files.

The drive was formatted with a different file system than expected.

The drive has a hardware encryption chip that consumes space.

A network forensic analyst is reviewing a packet capture from a suspected data exfiltration event. The analyst notices that the traffic to an external IP address uses a non-standard port and the payload appears to be base64-encoded. Which finding is MOST significant for the investigation?

The traffic uses TCP as the transport protocol.

The external IP address is in a foreign country.

The packet capture was taken during business hours.

The use of a non-standard port and encoded payload suggests an attempt to evade detection.

A forensic examiner is analyzing a suspect's hard drive and finds a large number of image files. The examiner suspects that hidden data may be embedded within the images. Which technique should the examiner use to detect hidden data?

Look for alternate data streams on the image files.

Use steganography detection tools to analyze the image files for embedded data.

Examine the file's creation and modification timestamps.

Check the file extensions and rename them to .txt to view hidden text.

GIAC Certified Enterprise Defender

Domain 2Objective 2

Digital Forensics Concepts and Application GCED Practice Questions (Page 1)

Part of the Incident Response and Forensics domain, which makes up ~29% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~20–35 in this domain), expect 7–12 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

9concepts

Questions 1–5

1foundation · easy
During which phase of a forensic investigation would an investigator create a bit-for-bit copy of a suspect's hard drive?
Select an answer first
2application · medium
A forensic examiner has completed the analysis of a compromised server and must now write a report for management and legal counsel. Which characteristic is most important for the report to be legally defensible?
Select an answer first
3application · medium
An examiner is investigating a drive that appears to have very little free space, but the user's visible files only account for a fraction of the drive's capacity. The examiner suspects anti-forensic techniques. Which technique could explain the missing space?
Select an answer first
4application · medium
A network forensic analyst is reviewing a packet capture from a suspected data exfiltration event. The analyst notices that the traffic to an external IP address uses a non-standard port and the payload appears to be base64-encoded. Which finding is MOST significant for the investigation?
Select an answer first
5application · medium
A forensic examiner is analyzing a suspect's hard drive and finds a large number of image files. The examiner suspects that hidden data may be embedded within the images. Which technique should the examiner use to detect hidden data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCED

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCED” is a trademark of its owner, used for identification only.